General Data Protection Law in the healthcare sector: prevention and punishment of unlawful conduct

Abstract

This article analyzes, from a criminal law perspective, the application of Brazil’s General Data Protection Law (LGPD) in the healthcare sector, with particular emphasis on the protection of sensitive personal data and criminal liability for unlawful conduct. Given the increasing digitization of health services and the significant volume of personal data processed by hospitals, clinics, health insurance operators, and digital platforms, the LGPD emerges as a key legal framework to safeguard privacy and intimacy in digital health. Following the constitutionalization of data protection by Constitutional Amendment No. 115/2022, the article examines the LGPD not merely as a regulatory norm, but as a benchmark for penal unlawfulness. It discusses the liability of health managers and professionals in light of Article 13, § 2 of the Brazilian Penal Code and the principles established by the LGPD, linking them to crimes such as breach of confidentiality, electronic fraud, and even bodily harm or homicide in cases of critical data breach. The research methodology is qualitative, based on doctrinal and legislative review, including scholars like Doneda, Sarlet, Rodotà, and Barbagalo, along with recent case law from Brazil’s Superior Court of Justice (STJ) and the National Data Protection Authority (ANPD). The article concludes that the LGPD serves as a transversal mechanism of compliance and criminal accountability in high-risk sectors such as healthcare, demanding the institutionalization of a robust culture of data protection.